Its been about a month since I last posted here, I’ve been busy studying for the VCAP5-DCD and been on holiday.

About four months ago I decided to give it another go. Having tried the 5.1 DCD exam previously and failed, i had a clear idea of the amount of work involved. I didn’t really want to wait for the VCIX exams to be released as I wanted the option of going for the VCDX5 in early 2016.

The first thing I did was go to Google and read all the reviews of the exam I could find. A common theme amongst all the posts was make the blueprint your bible, and it’s true. In there you will find exactly what you need to know. Read it from cover to cover, then read it again.

Its a tough exam. Really tough. I’m not going to rehash what other (more capable) bloggers have covered about the exam suffice to say that I finished with about 20 minutes to spare, took a couple of deep breaths and went through the questions again. This was a huge help as I tweaked one of my designs and saw a glaring error in one of the drag-and-drop questions.

Carrying on with our VSAN enabled nested environment, we’ll be deploying our new hosts using the VCSA and the web client and not the C# client. Reason? Well we will be setting specific parameters for the vCPU to pass through the virtualization extensions. otherwise we will need to do this by editing the VMX file.

Now that we have the networking in place that we configured in the previous post we’ll go on to deploy three ESXi VM’s.

Each host should have the following spec:

2 X CPU or cores (Min requirement for ESXi)

6GB Ram (Min requirement for VSAN)

2 X Nics on the VM Network

2 X Nics of the LAN Network

1 X 10g HDD disk (ESXi install)

1 X SSD disk for the caching tier.

1 X HDD for data Tier.

The VSAN disk configuration of my nested ESXi servers is:

1 X 40GB SSD

1 X 100GB HDD

This configuration worked for me ask I was able to run a couple of smaller VM’s in my nested environment. I was also able to add a second 100GB HDD to continue to test VSAN functionality, such as striping and disk policies.

Installing a nested ESXi host.

1.Log in using an account that has permission to configure the environment.

2.Select Home and the Hosts and Clusters

3.Select the Hosts and Clusters icon and then select your primary host, right click and Select New Virtual Machine and New Virtual Machine.

4.Select the Create New Virtual Machine and Click Next.

5. Give the Virtual Machine a name and select the Datacenter we created in Part 7 and Click Next.

6. Select your physical host for the Compute Resource and Click Next.

6. Select the disk you want to run the ESXi host on and Click Next. If you have both a SSD and a HDD look to put the primary disk on the HDD. Once ESXi boots it runs mostly in memory.

7. Select Compatable With: ESXi 6.0 and later and Click Next.

7. Guest OS Family set to Other and Guest OS Version:Version ESXi 6.x and Click Next.

8. Ok so a fair bit to do here:8.1. Set the VM to have two cores and one CPU. This will save on licensing if you have a VMUG advantage subscription. In addition you need to tick the Hardware Virtualization check box to pass through the additional virtualization features of the CPU. If you don’t you’ll get an error during install.8.2. 6 GB Ram as the minimum supported with VSAN enabled nodes.8.3. Your first HDD reduce to 10GB8.4. Add three additional Nic’s. Set them in this order. NIC 1 and NIC2 on the VM Network, NIC 3 and NIC4 on the LAN Network. Ensure that you set you NIC type to VMXNET3.8.5. Add two disks. One SSD and One HDD. The SSD can be small,10GB, if required. and the HDD should be at least 50GB. If you don’t have an SSD, have a look at the end of this post and I’ll include a link to instructions which will show you how to “fool” ESXi into thinking you have a SSD when you don’t.8.6. Add the ESXi ISO to the new CD/DVD Drive, check the Connect Check box.8.6. Click Next,

9. Review your changes and click Next.

A brief pause here to look at what we’ve built. One ESXi VM with the components necessary for to to be a part of a VSAN cluster. 10. Power on the VM. Right Click the VM and select Power On.

11. Open a console to the VM. (Click Launch Remote Console).

12. Boot Strapping and kernel goodness loading

11. More goodness

12. Press Enter

13. Press F11

14. Select the small 10GB disk (not the SSD).

15. Choose your keyboard type and press Enter.

16. Enter in your root password and confirm.

17. Scanning

18.1 This error will appear if you have not set the Hardware Virtualization Flag in the CPU settings of the VM and you’ll need to go back and set it.

18.2 Example of the Settings.

19. Press F11.

20. Installing.

21. Press Enter

22. VM rebooting.

There we go one working ESXi VM. Now we are going to need another two of these to make up the three minimum required for VSAN.

To mark a disk as SSD; This is one way to do it and this is another I’ve tried both methods and they work. I personally prefer William Lam’s method.

So in the previous post we added our primary host to the vcsa we built in part 4. Before we build our first virtualized ESXi host we need to add a single standard virtual switch. The foundation for this is discussed in part 2, please take a moment to read it as we’ll be using some of those details.We want the primary network layer to look like the diagram below. two standard switches. vSwitch0 will already have been created by default and you’ll have a few VM in the VM Network already. The second, vSwitch1, will have only one port group, which I have called LAN. This port is going to be trunked to all VLANs. In addition we’ll also set the configuration for VM Network so that nested ESXi servers pass traffic from their nested VM’s correctly.

Configuring the networking for the VM Network port group.

1.Log in using an account that has permission to configure the environment.

2.Select Home and the Hosts and Clusters

3.Select the Hosts and Clusters icon and then select your primary host.

In today’s post we’ll look at adding your primary ESXi host (this is the host that holds your nested environment) to the vCenter server and configuring it up.

Just before we add the primary host we’ll be needing a Datacenter.

1.Log in using an account that has permission to configure the environment.

2.Select Home and the Hosts and Clusters

3.Right click on the VCSA we created and select New Datacenter.

4.Give it a logical name and click OK.

Now to add the primary host.

1.Right click the newly created Datacenter and select Add Host.

2.Add in the hostname or IP address of the Primary host and select Next.

3.Enter in the Username (most likely root) and the password you use to administer this host. Click Next.

4.Check the host summary and click Next. Note that I already have some VM’s created and they have shown up in the Virtual Machines pane.

5.Select a license key, if you have one installed. Click Next.

6.Leave lock down mode disable for now. In later posts we’ll be ssh’ing into the hosts to do a few things and have a poke around. It’s usually my preference to leave lockdown mode disabled unless I have a specific reason not to do so.

7.Select your Datacenter and click Next.

8.Review the host detail and select Finish.

OK so now we’ve added the first host we’ll want to setup networking (next post) for our nested hosts. Just before we get into that, have a look the Mac learning fling here and William Lam’s blog post about it here. I would recommend getting that installed.

Now we have a working PSC and a working VCSA, and the whole set-up enabled for domain authentication. Next we should add a user (you) and if your using ESXi as your hypervizor then next post we’ll add your ESXi host to the VCSA, adding the host won’t be necessary if you’re using workstation.

But first it is important to know, you don’t technically need a directory service but most places will have one and usually it’ll be Microsoft’s Active Directory that’s why I’m including it in these posts.

So before you begin the below make sure you have an Active Directory account created for yourself.

1. If you aren’t already logged in, browse to the vSphere client, accepting any security errors (https://vcsa.domain:9443/vsphere-client), and login using administrator@your.vmwaredomain. In my case I left the SSO domain name as the default. administrator@vsphere.local

2. Select Home and then Hosts and Clusters

3. Select your VCSA server

3.1 Manage

3.2 Permissions

3.3 Then click the “+” icon.

4. Select Add

5. Select your Domain

5.1 Type in the name of the user account or group you want to search for.

5.2 Select the name

5.3 Select Add

5.4 Select OK

6. Once your user is added assign a role and select OK.

You should now see your user or group added to your VCSA. Depending on your permissions you should now be able to login do various bits and pieces.

Permissions can be added to items below the VCSA but it is important to note that permission propagate down the tree. So adding a user to the cluster will give that user rights to the cluster and all objects controlled by the cluster (unless explicitly denied), however this will not give you rights to the VCSA.

Since the aim in these posts is to make a simple lab environment that you can use to test various scenarios, we’ll also want to have domain authentication set-up. However the lab will still run without domain authentication and you can use local user accounts. I personally prefer to enable domain authentication.

Remember, DNS is a very important part of Identity, so if you run into issues you might want to add that to your trouble shooting.

This part of the guide can be taken on its own but is based on a separatePlatform Services Controller andvCenter Server Appliance.

1.Browse to the vSphere client, accepting any security errors (https://vcsa.domain:9443/vsphere-client), and login usingadministrator@your.vmwaredomain. In my case I left the SSO domain name as the default.administrator@vsphere.local.

2.Browse toAdministrator, thenSystem Configurationand select yourPSC

3.SelectActive Directory and clickJoin.

4.Enter in the details for aDomain a user account that has permissions to join computer to the domain.Note:The user account format has to be@. ClickOK when done.

5.Once this has completed (without any errors) reboot the PSC. Right click on the node and selectReboot.

6.Enter in a reason for rebooting the node if you want (I prefer to do this. Its a good habit to get into) and clickOK. Rebooting the PSC will not mess up your VCSA session but will take about 5 mins or so.

7.Once its back, refresh the page. You might need to browse back to theSystem Configuration page. You should now see the domain field populated and the join button will be greyed out.

8.Click onAdministration to take you back a page.

9.Click onConfiguration,select theIdentity Sources tab and click the “+” sign to add a new identity source.

10.On this popup you will be offered four choices.

10.1Select Active Directory (Integrated Windows Authentication Once you’ve selected that the Domain name field should automatically populate. If it didn’t then your PSC hasn’t joined the domain correctly.

10.2SelectUse Service Principle Name (SPN). STS/

10.3Enter in theService Principle name using the@. This account should have permission to browse your domain.

10.4And the Passwordfor the above account.

10.5Click OK

11.If all goes well then you should see a new entry in you identity sources.

And that’s it you can now go and add your first domain user account to the permissions, which I’ll show you in the next post.

The VCSA 6 now offers feature parity with the windows edition, including the long awaited for linked mode. In fact when you look at the vSphere 6.0 configuration maximums doc it doesn’t have a separate section for the windows deployment and the appliance deployment.

Now in your environment you need to make a decision, Windows based or Appliance based. For me, personally, I’ve long been a fan of the appliance. Its easy to deploy and doesn’t require a windows license, not that I’m against windows at all.

For a small lab it’s quite a beefy install, even at the tiny deployment. 8GB Ram and 2 CPU’s and the HDD requirements can be anything from 30GB to 120GB depending on whether you are using the imbedded controller or not. http://kb.vmware.com/kb/2106572

But given all of that we will cheat a bit with the memory requirements. After deployment, drop it down to 4GB. Please not that this is not supported.

As in the previous post, if you haven’t done so already, you need to install the Client integration plugin which can be found in the iso at vcsaVMware-ClientIntegrationPlugin-6.0.0.exe.

In this post we’ll look at installing the Platform Services Controller (PSC).

Forgetting about ESX for a minute, this new iteration of vSphere is, in my opinion, a huge leap forward for administrators. It feels like the virtual appliance architecture has finally come of age. The split of duties makes a great deal of sense. The PSC is responsible for Single Sign On (SSO), Licensing, and as a Certificate Authority, while the VCSA hosts the inventory service, the web client and others.

So why on different appliances for this lab? Well going forward, in future blog posts, we’ll look at connecting a second VCSA to the PSC.

This first VCSA and PSC will lay the foundation for this and future labs

OK onward.

To install the VCSA and/or PSC you you will need to install the VMware client intergration plugin. can be found in the iso at vcsaVMware-ClientIntegrationPlugin-6.0.0.exe. To be honest I’m still not 100% sure why this is needed. I’ve seed similar functionality using HTML5.

This part of the installer does assume that you have a DC up and running. If you don’t you should get one setup before continuing as we will need it later, if you choose to follow that part of the guide.

Once that’s done we can fire up the installer and get the PSC installed.Firstly unpack the ISO to your local drive. C:/temp for example.

5. Enter in the IP address, username (usually root) and the password of the ESXi server you are deploying the PSC to.Click Next.

6. Enter in the name of the PSC and give it a password. Click Next.

7. On this screen you have three choices. For our lab we’ll select “Install Platform Services Controller”. Click Next.

8. Select Create a new SSO Domain. Select a password for the SSO domain. This is different from the appliance root password, which is for the OS. If you don’t write down your lab passwords ,choose something easy to remember, We’ll need this password later. Enter in the SSO Domain name as vsphere.local and the site name as -site-1. Click Next.

9. Appliance size… Well nothing to choose here… Click Next.

10. Select the datastore you want to deploy the PSC onto. The SATA drive should be fine for this as it’s a relatively small appliance.

11. Networking is King here and you’ll need to be vigilant going through this. For the time sync select “Synchronize appliance with ESXi host” and tick “Enable ssh”. Click Next.

12. Check and check and check your settings. Once you are happy, Click Finish.

13. The installer will now go off and setup the PSC on your ESXi server.

Networking

While we can run all our services over one network segment, for this lab we really want three VLANs.

Networking setup will differ slightly for ESXi and Workstation but both will use the three VLANs.

Use

Example IP Range

Note

VM and Management

192.168.0.0

Best to use you existing home network.

VSAN (vlan 30)

192.168.100.0

Internal Only

vMotion (vlan 40)

192.168.110.0

Internal Only

It is considered best practice to separate out various types of network traffic. Usually you would separate out your VM traffic from your management but for this lab we will keep them together. We will separate out vMotion and VSAN traffic though.

ESXi: When I’m designing a vSphere environment with rack mount servers in mind I usually separate management traffic out into a separate standard virtual switch (2 x 1g ports) and all other traffic is sent to 2 x 10g ports through a distributed virtual switch using vlans to separate the traffic further and NIOC to control bandwidth.

All righty then, what’s this going to look like for us?In Workstation:

In ESXi:

So far, so good. For Workstation nothing else needs to be done.

As you can see from the ESXi image above I haven’t specified a physical adapter for vSwitch1, With ESXi if network traffic is on the same VLAN and on the same virtual switch, it won’t go the the physical switch. The virtual switch, an in memory construct, will just pass the traffic along, however if you need to cross VLANs, the traffic will need to be passed to the physical switch for routing across VLANs. In this case, its very handy as we won’t want traffic to pass between the VSAN port group and the vMotion port group. EDIT: What we want to do is set-up the LAN port group with VLAN 4095. This will enable ESXi to pass the vlan traffic about correctly.

Now is ESXi we need to make two changes to the vMotion and VSAN port groups, Enable Promiscuous Mode and Forget Transmits:

William Lam of Virtually Ghetto has a great write up here discussing the reasons for this.

So those are the networking eccentricities, Next we’ll look at getting our first VCSA with a dedicated Platform Services Controller up and running.

Just a note: I had hoped to post this sooner but family and holiday commitments took over.